weather
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
curlto perform network requests and save image data to the/tmpdirectory. These operations are consistent with the skill's primary purpose of retrieving weather forecasts. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
wttr.inandopen-meteo.com. These are well-known, established public services frequently used for programmatic weather data access. - [INDIRECT_PROMPT_INJECTION]: The skill displays data fetched from external web services, representing a standard attack surface for indirect prompt injection.
- Ingestion points: External content fetched from
wttr.inandapi.open-meteo.com(SKILL.md). - Boundary markers: None provided to separate API output from agent instructions.
- Capability inventory: Network access via
curland file writing capability to/tmp(SKILL.md). - Sanitization: Instructions mention basic URL-encoding for input parameters (e.g., city names).
Audit Metadata